How to deal with this “lea” instructions generated by objdump?

Question

So basically I am using objdump to disassemble a binary from `GNU Coreutils", on 32 bit Linux x86.

In the disassembled code, I found one "broken" instruction like this:

 804bb49:   8d 04 ed 00 00 00 00    lea    0x0(,%ebp,8),%eax

I asked a related question about a very similar instruction here, in that question, I think it should be a jump table related instruction, but how about this one ? I am quite confused..

Could anyone give me some help?

Answer 1

I don't know what makes you think this instruction is "broken" - the fact that there is a comma right after a bracket, without a parameter in between? In this case, the disassembler just doesn't show the parameter because it's "zero" (more precisely, it specifies "no register" where "any processor register" would be allowed).

What happens here is: when addressing memory locations, the processor has a mode where it adresses

• a base offset
• plus the content of one processor register
• plus the content of another processor register, multiplied by an integer that can be 1,2,4 or 8

This calculation is quite fast, as it's done in special hardware in the address bus subsystem.

The lea (load effective address) instruction is a special kind of RAM access -- it calculates the address of the operand, but then, it moves the address, not the data at that address, into the destination register.

So your 'broken' instruction moves a base offset of 0, plus "no" first register, plus 8 times the content of ebp, into eax. The same could have been done by moving ebp to eax and multiplying by 8, or moving and shifting left by 3 bits, but the lea instruction is probably a bit faster (because, as i said, it's done in specialized address bus hardware), so the compiler used that one to save a few cycles. Nothing is broken here.

You might want to take a look at a i386 assembler reference when disassembling, the indirect adressing is quite well explained in the OS X Assembler reference, scroll down to "Indirect Memory Operands".

Answer 2

what does broken mean

the instruction in either this post or in your earlier post do not seem to be broken

if you are confused with AT&T syntax then you can ask objdump to disassemble in intel syntax

a better explanation of broken can get a better answer

root@box:/home/dsl/gcctests/test# cat testjt.c 
void naked (void)
{
        asm( ".globl _naked\n");
        asm( "_naked:\n");
        asm( "jmp *0x80509e4(,%eax,4)");
        asm( "lea 0x0(,%ebp,8),%eax");
        asm( "ret");
}
int main (void)
{
        naked();
        return 0;
}


root@box:/home/dsl/gcctests/test# objdump -t ./testjt | grep _naked
08048357 g       .text  00000000              _naked


root@box:/home/dsl/gcctests/test# objdump -d --disassembler-option=intel  ./testjt | grep -A 2 _naked


08048357 <_naked>:
 8048357:       ff 24 85 e4 09 05 08    jmp    DWORD PTR [eax*4+134547940]
 804835e:       8d 04 ed 00 00 00 00    lea    eax,[ebp*8]


root@box:/home/dsl/gcctests/test#